6.2
高危
48 个模型检测该样本为恶意！
重新分析
更多

02f41fdda70c06784cceadc52eb976538f65a46ef22f0700f5daa13a9e856587

b363ff34e7528ec9d01d2621dde96bdd.exe

分析耗时

115s

最近分析

文件大小

88.0KB
静态报毒 动态报毒 AI SCORE=86 AIDETECTVM ALI2000008 AQPF CONFIDENCE DOWNLOADER34 DROPPERX ELDORADO EMZA ENAL FAREIT FM0@AIMFLTDB GDSDA GRAFTOR GULOADER HIGH CONFIDENCE HRXXFF KRYPTIK MALWARE1 OIZJH PDVN R347640 SCORE TSCOPE UNCLASSIFIEDMALWARE@0 USXVPHE20 VBKRYPT VEBZENPAK WACATAC ZEVBAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FYM!B363FF34E752 20200910 6.0.6.653
Alibaba Trojan:Win32/vbcrypt.ali2000008 20190527 0.3.0.5
Avast Win32:DropperX-gen [Drp] 20200910 18.4.3895.0
Kingsoft 20200910 2013.8.14.323
Tencent Win32.Trojan.Vebzenpak.Pdvn 20200910 1.0.0.1
CrowdStrike win/malicious_confidence_60% (W) 20190702 1.0
静态指标
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:2493879205&cup2hreq=63209f7a94dd63d3cd385c6734287a4c80eed0e92c2edc329ed18dc8acd2fb3d
Performs some HTTP requests (4 个事件)
request HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request HEAD http://r1---sn-j5o76n7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.105&mm=28&mn=sn-j5o76n7e&ms=nvh&mt=1619852415&mv=m&mvi=1&pl=23&shardbypass=yes
request HEAD http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=e825ecbcaa78e175&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619852415&mv=m
request POST https://update.googleapis.com/service/update2?cup2key=10:2493879205&cup2hreq=63209f7a94dd63d3cd385c6734287a4c80eed0e92c2edc329ed18dc8acd2fb3d
Sends data using the HTTP POST Method (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:2493879205&cup2hreq=63209f7a94dd63d3cd385c6734287a4c80eed0e92c2edc329ed18dc8acd2fb3d
Allocates read-write-execute memory (usually to unpack itself) (4 个事件)
Time & API Arguments Status Return Repeated
1619861119.236924
NtAllocateVirtualMemory
process_identifier: 2248
region_size: 61440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00480000
success 0 0
1619861121.596924
NtProtectVirtualMemory
process_identifier: 2248
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 876544
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d40000
success 0 0
1619881469.950501
NtProtectVirtualMemory
process_identifier: 2144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 876544
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d40000
success 0 0
1619881537.545124
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000004050000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Foreign language identified in PE resource (1 个事件)
name RT_VERSION language LANG_CHINESE offset 0x00015120 filetype data sublanguage SUBLANG_CHINESE_TRADITIONAL size 0x00000254
Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)
Time & API Arguments Status Return Repeated
1619861118.549924
NtProtectVirtualMemory
process_identifier: 2248
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 24576
protection: 32 (PAGE_EXECUTE_READ)
process_handle: 0xffffffff
base_address: 0x003c0000
success 0 0
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 203.208.40.34
Enumerates services, possibly for anti-virtualization (1 个事件)
Time & API Arguments Status Return Repeated
1619861121.627924
EnumServicesStatusA
service_handle: 0x004f0f10
service_type: 48
service_status: 3
success 1 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.27.142:443
File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Graftor.816111
FireEye Generic.mg.b363ff34e7528ec9
CAT-QuickHeal Trojan.Vebzenpak
McAfee Fareit-FYM!B363FF34E752
Malwarebytes Trojan.GuLoader.VB
Zillya Trojan.Injector.Win32.764064
Sangfor Malware
K7AntiVirus Trojan ( 0056c5881 )
Alibaba Trojan:Win32/vbcrypt.ali2000008
K7GW Trojan ( 0056c5881 )
Arcabit Trojan.Graftor.DC73EF
Invincea Mal/Generic-S
BitDefenderTheta Gen:NN.ZevbaF.34216.fm0@aiMFlTdb
Cyren W32/Kryptik.BTN.gen!Eldorado
Symantec Trojan Horse
APEX Malicious
Avast Win32:DropperX-gen [Drp]
Kaspersky Trojan.Win32.Vebzenpak.zdi
BitDefender Gen:Variant.Graftor.816111
NANO-Antivirus Trojan.Win32.Vebzenpak.hrxxff
Paloalto generic.ml
AegisLab Trojan.Win32.Vebzenpak.4!c
Ad-Aware Gen:Variant.Graftor.816111
Comodo .UnclassifiedMalware@0
F-Secure Trojan.TR/Injector.oizjh
DrWeb Trojan.DownLoader34.23026
VIPRE Trojan.Win32.Generic!BT
TrendMicro Trojan.MSIL.WACATAC.USXVPHE20
Jiangmin Trojan.VBKrypt.aqpf
Avira TR/Injector.oizjh
Antiy-AVL Trojan/Win32.Injector
Microsoft Trojan:Win32/Guloader.VB!MTB
ZoneAlarm Trojan.Win32.Vebzenpak.zdi
GData Gen:Variant.Graftor.816111
Cynet Malicious (score: 85)
AhnLab-V3 Trojan/Win32.Kryptik.R347640
VBA32 TScope.Trojan.VB
ALYac Gen:Variant.Graftor.816111
ESET-NOD32 a variant of Win32/Injector.EMZA
TrendMicro-HouseCall Trojan.MSIL.WACATAC.USXVPHE20
Tencent Win32.Trojan.Vebzenpak.Pdvn
MAX malware (ai score=86)
Fortinet W32/Injector.ENAL!tr
Panda Trj/GdSda.A
CrowdStrike win/malicious_confidence_60% (W)
Qihoo-360 Win32/Trojan.1d5
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2015-01-29 22:12:55

Imports

Library MSVBVM60.DLL:
• 0x401000 _CIcos
• 0x401004 _adj_fptan
• 0x401008 __vbaVarMove
• 0x40100c
• 0x401010 __vbaFreeVar
• 0x401014 __vbaLenBstr
• 0x401018 __vbaFreeVarList
• 0x40101c
• 0x401020 _adj_fdiv_m64
• 0x401024
• 0x401028 _adj_fprem1
• 0x40102c
• 0x401030 __vbaStrCat
• 0x401034
• 0x401038
• 0x40103c
• 0x401044
• 0x401048
• 0x40104c
• 0x401050 _adj_fdiv_m32
• 0x401054
• 0x401058
• 0x40105c __vbaAryDestruct
• 0x401060
• 0x401064 _adj_fdiv_m16i
• 0x401068
• 0x40106c __vbaObjSetAddref
• 0x401070 _adj_fdivr_m16i
• 0x401074
• 0x401078 __vbaCyStr
• 0x40107c
• 0x401080 __vbaFPFix
• 0x401084 __vbaFpR8
• 0x401088 _CIsin
• 0x40108c
• 0x401090 __vbaChkstk
• 0x401094 EVENT_SINK_AddRef
• 0x401098 __vbaStrCmp
• 0x40109c __vbaVarTstEq
• 0x4010a0 __vbaAryConstruct2
• 0x4010a4 __vbaObjVar
• 0x4010a8
• 0x4010ac
• 0x4010b0
• 0x4010b4
• 0x4010b8 _adj_fpatan
• 0x4010bc
• 0x4010c0 __vbaRedim
• 0x4010c4
• 0x4010c8 EVENT_SINK_Release
• 0x4010cc
• 0x4010d0 _CIsqrt
• 0x4010d8 __vbaFpCmpCy
• 0x4010dc __vbaExceptHandler
• 0x4010e0
• 0x4010e4 _adj_fprem
• 0x4010e8 _adj_fdivr_m64
• 0x4010ec
• 0x4010f0
• 0x4010f4 __vbaVarErrI4
• 0x4010f8
• 0x4010fc __vbaFPException
• 0x401100 __vbaStrVarVal
• 0x401104
• 0x401108
• 0x40110c
• 0x401110 _CIlog
• 0x401114 __vbaNew2
• 0x401118 __vbaInStr
• 0x40111c
• 0x401120 __vbaR8Str
• 0x401124 _adj_fdiv_m32i
• 0x401128 _adj_fdivr_m32i
• 0x40112c __vbaStrCopy
• 0x401130
• 0x401134 __vbaI4Str
• 0x401138 __vbaFreeStrList
• 0x40113c _adj_fdivr_m32
• 0x401140
• 0x401144 _adj_fdiv_r
• 0x401148
• 0x40114c
• 0x401150 __vbaLateMemCall
• 0x401154 __vbaVarAdd
• 0x401158 __vbaStrComp
• 0x40115c __vbaVarDup
• 0x401160
• 0x401164
• 0x401168 _CIatan
• 0x40116c __vbaStrMove
• 0x401170
• 0x401174
• 0x401178 _allmul
• 0x40117c
• 0x401180 _CItan
• 0x401184 __vbaFPInt
• 0x401188 _CIexp
• 0x40118c __vbaFreeObj
• 0x401190 __vbaFreeStr

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49191 113.108.239.130 r1---sn-j5o76n7e.gvt1.com 80
192.168.56.101 49189 203.208.41.98 update.googleapis.com 443
192.168.56.101 49192 58.63.233.69 r4---sn-j5o76n7l.gvt1.com 80
192.168.56.101 49190 203.208.41.65 redirector.gvt1.com 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 49713 114.114.114.114 53
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702

HTTP & HTTPS Requests

URI Data
http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=e825ecbcaa78e175&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619852415&mv=m 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=e825ecbcaa78e175&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619852415&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r4---sn-j5o76n7l.gvt1.com
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com
http://r1---sn-j5o76n7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.105&mm=28&mn=sn-j5o76n7e&ms=nvh&mt=1619852415&mv=m&mvi=1&pl=23&shardbypass=yes 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.105&mm=28&mn=sn-j5o76n7e&ms=nvh&mt=1619852415&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o76n7e.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.